CVE-2026-30913: Flarum Nicknames Extension XSS Vulnerability

CVE-2026-30913 Overview

Flarum is open-source forum software. A Cross-Site Scripting (XSS) vulnerability exists in the flarum/nicknames extension that allows registered users to inject malicious hyperlinks into plain-text notification emails. When the nicknames extension is enabled, a user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, potentially misleading recipients into visiting attacker-controlled domains.

Critical Impact

Registered users can craft malicious nicknames containing URL-like strings that email clients render as clickable hyperlinks, enabling phishing attacks against forum users who receive notification emails.

Affected Products

• Flarum Forum Software with flarum/nicknames extension enabled
• Flarum Nicknames extension versions prior to v1.8

Discovery Timeline

• 2026-03-10 - CVE-2026-30913 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30913

Vulnerability Analysis

This vulnerability represents a Content Injection weakness (CWE-79) that exploits insufficient input validation in the Flarum nicknames extension. The core issue lies in how user-supplied nickname values are processed and included in email notifications without proper sanitization or encoding.

When a registered user updates their nickname through the forum interface, the value is stored and later used verbatim in plain-text email notifications sent to other users. Email clients that automatically detect and render URLs create clickable hyperlinks from these nickname values, enabling social engineering attacks against unsuspecting recipients.

The attack requires user interaction (the victim must click the malicious link in the email) and low privileges (an authenticated forum account), but can be executed remotely across the network. The vulnerability primarily impacts confidentiality and integrity through potential credential theft or malware distribution via phishing.

Root Cause

The root cause is improper input validation in the nickname field handling within the flarum/nicknames extension. The extension fails to sanitize or validate nickname inputs for URL-like patterns before inserting them into email notification templates. This allows attackers to embed strings that email clients interpret as hyperlinks, bypassing expected content boundaries.

Attack Vector

An attacker with a registered Flarum account can exploit this vulnerability through the following mechanism:

1. The attacker registers or logs into a Flarum forum with the nicknames extension enabled
2. The attacker modifies their nickname to contain a URL-like string pointing to a malicious domain (e.g., Check out https://attacker-site.example)
3. When the attacker participates in forum activities (posts, replies, mentions), notification emails are generated
4. These emails include the attacker's nickname verbatim in the plain-text body
5. Recipients' email clients automatically render the URL as a clickable hyperlink
6. Victims who click the link are directed to the attacker-controlled domain for credential phishing or malware delivery

The vulnerability is exploited through the network with low complexity, requiring only basic authentication and user interaction. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-30913

Indicators of Compromise

• User nicknames containing URL patterns or domain names in the Flarum database
• Unusual nickname update activity from specific user accounts
• Reports from users about suspicious links in notification emails
• Email bounce-backs or complaints related to phishing content

Detection Strategies

• Monitor nickname field changes for URL-like patterns using regex-based content filtering
• Implement logging for all nickname modifications with timestamp and source IP tracking
• Deploy email security solutions that scan outbound notifications for embedded URLs
• Review user activity logs for bulk or automated nickname changes

Monitoring Recommendations

• Enable verbose logging on the Flarum application to track nickname modification events
• Configure email gateway logging to capture outbound notification content for forensic analysis
• Implement alerting for nicknames containing common URL schemes such as http://, https://, or ftp://

How to Mitigate CVE-2026-30913

Immediate Actions Required

• Upgrade the flarum/nicknames extension to version v1.8 or later immediately
• Review existing user nicknames in the database for suspicious URL-like content
• Consider temporarily disabling the nicknames extension until patching is complete
• Notify users about potential phishing emails and advise them not to click suspicious links

Patch Information

The Flarum development team has addressed this vulnerability in the nicknames extension. The fix is available in version 1.8 of the extension. The specific security patch can be reviewed in the GitHub commit. Administrators should update to the latest version using Composer:

composer update flarum/nicknames

Workarounds

• Implement server-side input validation to strip or reject URL patterns in nickname fields
• Configure email templates to wrap user-generated content in plain-text formatting that prevents link rendering
• Apply Content Security Policy headers to limit outbound URL schemes in user-generated content
• Consider disabling plain-text email notifications in favor of HTML emails with proper URL sanitization

# Configuration example - Validate nicknames before storage
# Add to your Flarum extension or middleware
# Reject nicknames containing URL schemes
php artisan tinker
>>> \Flarum\User\User::whereRaw("nickname REGEXP 'https?://'")
        ->update(['nickname' => null]);